Skip to content

fix: accept SSN area numbers up to 899 in @verifySSN (2.x) #3672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fzipi wants to merge 1 commit into
base: v2/master
Choose a base branch
from
+73 −2
Open

fix: accept SSN area numbers up to 899 in @verifySSN (2.x) #3672

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions apache2/re_operators.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3566,7 +3566,7 @@
* \retval 0 On Invalid SSN
* \retval 1 On Valid SSN
*/
static int ssn_verify(modsec_rec *msr, const char *ssnumber, int len) {

Check failure on line 3569 in apache2/re_operators.c

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Refactor this function to reduce its Cognitive Complexity from 26 to the 25 allowed. 


See more on https://sonarcloud.io/project/issues?id=owasp-modsecurity_ModSecurity&issues=AaE1Rh97lRXbzGgnBCEY&open=AaE1Rh97lRXbzGgnBCEY&pullRequest=3672
assert(msr != NULL);
assert(ssnumber != NULL);
int i;
Expand Down Expand Up @@ -3621,8 +3621,9 @@
if (area == 0 || serial == 0 || grp == 0)
goto invalid;

/* More tests */
if (area >= 740 || area == 666)
/* Since the 2011 randomisation every area number is assigned except
* 000, 666 and 900-999 (#2970). */
if (area == 666 || area >= 900)
goto invalid;

return 1;
Expand Down
70 changes: 70 additions & 0 deletions tests/regression/misc/50-verifyssn.t
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
### @verifySSN area number ranges (#2970)

{
type => "misc",
comment => '@verifySSN area 574 (pre-2011 range)',
conf => q(
SecRuleEngine On
SecRule ARGS "@verifySSN \\d{3}-?\\d{2}-?\\d{4}" "id:500970,phase:1,deny,status:403,capture"
),
match_log => {
error => [ qr/Access denied with code 403 \(phase 1\)/, 1 ],
},
match_response => {
status => qr/^403$/,
},
request => new HTTP::Request(
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt?ssn=574-57-8065",
),
},
{
type => "misc",
comment => '@verifySSN area 800 is valid since the 2011 randomisation',
conf => q(
SecRuleEngine On
SecRule ARGS "@verifySSN \\d{3}-?\\d{2}-?\\d{4}" "id:500970,phase:1,deny,status:403,capture"
),
match_log => {
error => [ qr/Access denied with code 403 \(phase 1\)/, 1 ],
},
match_response => {
status => qr/^403$/,
},
request => new HTTP::Request(
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt?ssn=800-57-8065",
),
},
{
type => "misc",
comment => '@verifySSN area 900 is never assigned',
conf => q(
SecRuleEngine On
SecRule ARGS "@verifySSN \\d{3}-?\\d{2}-?\\d{4}" "id:500970,phase:1,deny,status:403,capture"
),
match_log => {
-error => [ qr/Access denied/, 1 ],
},
match_response => {
status => qr/^200$/,
},
request => new HTTP::Request(
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt?ssn=900-57-8065",
),
},
{
type => "misc",
comment => '@verifySSN area 666 is never assigned',
conf => q(
SecRuleEngine On
SecRule ARGS "@verifySSN \\d{3}-?\\d{2}-?\\d{4}" "id:500970,phase:1,deny,status:403,capture"
),
match_log => {
-error => [ qr/Access denied/, 1 ],
},
match_response => {
status => qr/^200$/,
},
request => new HTTP::Request(
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt?ssn=666-57-8065",
),
},
Loading